Windows Bind Filter Driver: Elevation of privilege through improper access control
Summary
A flaw in the Windows Bind Filter Driver (bindflt.sys) allows an authorized local user to elevate privileges. The attacker needs a valid local logon and low privileges, so the vulnerability is not directly reachable from the internet. It is mainly relevant after an initial compromise, for example through phishing or on shared multi-user systems.
Affected
- Windows 11 version 23H2 below 10.0.22631.7652 (x64 and ARM64; the build number is disputed, see research notes)
- Windows Server 2025 (including Server Core) below 10.0.26100.33650
Fixed in
- Windows 11 version 23H2: October 2026 cumulative update KB5126653 (reported, not yet confirmed against the MSRC advisory)
- Windows Server 2025: KB5126646 (reported by a third party, not confirmed against the Microsoft Update Catalog)
Workaround
Unknown. No vendor-documented mitigation has been identified. Installing the update is the recommended fix.
Exploitation
No known exploitation. The CVE is not in the CISA KEV catalog. CISA SSVC lists exploitation as none, automatable as no and technical impact as total. No public proof of concept was found, but this does not prove that none exists.
Our recommendation
- Install the October 2026 cumulative update on all affected Windows 11 23H2 and Windows Server 2025 systems, and verify the build number in the MSRC advisory.
- Prioritise systems with several local users, Remote Desktop or terminal servers, developer workstations and container or virtualisation hosts.
- Restrict local logons and review local administrator rights.
- Monitor for unusual privilege changes and new local administrator accounts.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-70299 msrc.microsoft.com
- NVD configuration via Vulners vulners.com
- Microsoft advisory mirror via Vulners (MS:CVE-2026-70299) vulners.com
- BleepingComputer: Windows 11 KB5127648 and KB5126653 cumulative updates www.bleepingcomputer.com
- Microsoft 365 Message Center MC1506288 mc.merill.net
- OpenCVE: CVE-2026-70299 app.opencve.io
- AskWoody: October 2026 Windows patches www.askwoody.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:44.
Original description (NVD)
Improper access control in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.